Possible to VLAN without Fortigate Managed Switch? Is my solution ok?

Question

Is it possible to have VLANs on the Fortigate 60E without a Foritgate Managed Switch? I currently only have a few unmanaged switches but need 3 networks on the firewall to be completely separate.

One method I have found seems to work but not sure if this is secure or correct is to create 3 new interfaces and assign different network addresses/subnet and then assign different ports to each. Then plug an unmanaged switch into each port and then you have 3 seperate networks. I have tested this and theres no pinging between networks and seems fine but wanted opinions?

Also I did see I could create a VLAN interface on ports but wasnt sure if this would work without the Fortigate Switch?

sw2090 · Accepted Answer

Just basically for understanding:

you do not need to have FortiNet Switches. Vlans are common use and will work with other brands too.

I use FortiGates with HP Switches and vlans work fine here.

You just have to have a managed switch (unmanaged ones are not vlan capable but also will not touch the vlan tag in your packets). If you have unmanaged switches then the devices connected to those switches will have to take care for the vlans. The FortiGate can only handle packets that are tagged in a vlan (or are not tagged in any) and it will only let out packets tagged over the vlan interface.

I recommend the use of managed switches because way not every device can handle vlan tagging. This is definitely the easier way :)

ede_pfau · Answer

VLANs are not a security feature. A VLAN isolates broadcast traffic from other networks on the same wire, possibly conserving bandwidth.

Yes, you can create a lot of networks and (virtual) firewall ports using VLANs on a FGT. This is convenient if you need more ports than available physically.

Your problem begins when the VLAN (tagged) traffic leaves the FGT. The next switch must be VLAN capable, that is, able to collect switch ports into a VLAN broadcast domain, able to read the VLAN tag etc. IMHO there are 'semi-managed' switches which are VLAN capable for only a few bucks (Netgear metal boxes for instance).

If you create a VLAN you would want to pass the traffic all through your network either to the gateway or the hosts. If the FGT is your gateway, your switches need to support VLANs so that tagged traffic can reach the hosts. Hosts (PCs) usually are not VLAN capable; a switch port declared as 'VLAN access port' would be part of the VLAN but remove the VLAN tag on egress to the host.

But this all is basic networking stuff and better explained elsewhere on the net. Answering your question, yes, you can create VLANs on the FGT and handle them with 3rd party switches.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded